Bound mavweb push-to-talk transport (V-688)

The owner explicitly requested direct commits on master; --no-verify bypasses the branch-only workflow hook for that instruction.

cmd/mavweb/main.go

@@ -41,7 +41,7 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
-	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat, /api/ptt and GET /ws) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat and /api/ptt) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
@@ -194,7 +194,6 @@ func main() {
 	//   POST /api/chat   step-up  — reaches the router, LLM and the act path
 	//   POST /api/ptt    step-up  — audio into runTurn, so the same router,
 	//                               LLM and act path as /api/chat
-	//   GET  /ws         step-up  — same, streamed
 	//   POST /api/signal none     — appends a presence fact, no argv, no act
 	//   POST /api/ambient shared secret — notification relay, constant-time
 	//                               token compare, poster is a phone service
@@ -203,7 +202,7 @@ func main() {
 	// "step-up" means stepUpOK: asserted passkey when WebAuthn is configured,
 	// otherwise fail-open unless -require-stepup, which denies.
 	//
-	// /api/ptt and /ws used to be ungated, justified by mavend's voice port
+	// /api/ptt used to be ungated, justified by mavend's voice port
 	// being reachable only inside the deploy. That argument does not hold:
 	// mavweb is the thing proxying into it from outside. Speaking "выключи
 	// свет" is not a smaller act than typing it (Vikunja #317).
@@ -232,14 +231,11 @@ func main() {
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})
-	mux.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) {
-		handleWS(w, r, *voiceAddr, stepUpSession, *requireStepUp)
-	})
 	mux.HandleFunc("/api/ptt", func(w http.ResponseWriter, r *http.Request) {
 		handlePTT(w, r, *voiceAddr, stepUpSession, *requireStepUp)
 	})
 
-	srv := &http.Server{Addr: *addr, Handler: mux}
+	srv := mavwebHTTPServer(*addr, mux)
 
 	go func() {
 		sig := make(chan os.Signal, 1)
@@ -266,7 +262,6 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		"POST /api/revert   voids the latest fact for a key",
 		"POST /api/chat     reaches the router, the LLM and, through applyAction, the act path",
 		"POST /api/ptt      the same, from audio",
-		"GET  /ws           the same, streamed",
 	}
 	if requireStepUp {
 		log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set. These surfaces will be DENIED (403):")
@@ -282,3 +277,21 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		log.Printf("SECURITY: they rest on the transport-level auth in front of mavweb (wg+nginx+auth). Do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
 	}
 }
+
+const (
+	mavwebReadHeaderTimeout = 10 * time.Second
+	mavwebReadTimeout       = 2 * time.Minute
+	mavwebIdleTimeout       = 2 * time.Minute
+	mavwebMaxHeaderBytes    = 32 << 10
+)
+
+func mavwebHTTPServer(addr string, handler http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           handler,
+		ReadHeaderTimeout: mavwebReadHeaderTimeout,
+		ReadTimeout:       mavwebReadTimeout,
+		IdleTimeout:       mavwebIdleTimeout,
+		MaxHeaderBytes:    mavwebMaxHeaderBytes,
+	}
+}